Security sql statements update against sql injection attacks.
[fa-stable.git] / sales / includes / db / sales_order_db.inc
1 <?php
2 /**********************************************************************
3     Copyright (C) FrontAccounting, LLC.
4         Released under the terms of the GNU General Public License, GPL, 
5         as published by the Free Software Foundation, either version 3 
6         of the License, or (at your option) any later version.
7     This program is distributed in the hope that it will be useful,
8     but WITHOUT ANY WARRANTY; without even the implied warranty of
9     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
10     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
11 ***********************************************************************/
12 //----------------------------------------------------------------------------------------
13 function add_sales_order(&$order)
14 {
15         global $loc_notification, $path_to_root;
16
17         begin_transaction();
18
19         $del_date = date2sql($order->due_date);
20         $order_type = 0; // this is default on new order
21         $sql = "INSERT INTO ".TB_PREF."sales_orders (type, debtor_no, branch_code, customer_ref, comments, ord_date,
22                 order_type, ship_via, deliver_to, delivery_address, contact_phone,
23                 contact_email, freight_cost, from_stk_loc, delivery_date)
24                 VALUES (" .db_escape($order_type) . "," . db_escape($order->customer_id) .
25                  ", " . db_escape($order->Branch) . ", ".
26                         db_escape($order->cust_ref) .",". 
27                         db_escape($order->Comments) .",'" . 
28                         date2sql($order->document_date) . "', " .
29                         db_escape($order->sales_type) . ", " .
30                         db_escape($order->ship_via)."," . 
31                         db_escape($order->deliver_to) . "," .
32                         db_escape($order->delivery_address) . ", " .
33                         db_escape($order->phone) . ", " . 
34                         db_escape($order->email) . ", " .
35                         db_escape($order->freight_cost) .", " . 
36                         db_escape($order->Location) .", " .
37                         db_escape($del_date) . ")";
38
39         db_query($sql, "order Cannot be Added");
40
41         $order_no = db_insert_id();
42         $order->trans_no = array($order_no=>0);
43
44         if ($loc_notification == 1)
45         {
46                 include_once($path_to_root . "/inventory/includes/inventory_db.inc");
47                 $st_ids = array();
48                 $st_names = array();
49                 $st_num = array();
50                 $st_reorder = array();
51         }
52         foreach ($order->line_items as $line)
53         {
54                 if ($loc_notification == 1 && is_inventory_item($line->stock_id))
55                 {
56                         $sql = "SELECT ".TB_PREF."loc_stock.*, ".TB_PREF."locations.location_name, ".TB_PREF."locations.email
57                                 FROM ".TB_PREF."loc_stock, ".TB_PREF."locations
58                                 WHERE ".TB_PREF."loc_stock.loc_code=".TB_PREF."locations.loc_code
59                                 AND ".TB_PREF."loc_stock.stock_id = '" . $line->stock_id . "'
60                                 AND ".TB_PREF."loc_stock.loc_code = '" . $order->Location . "'";
61                         $res = db_query($sql,"a location could not be retreived");
62                         $loc = db_fetch($res);
63                         if ($loc['email'] != "")
64                         {
65                                 $qoh = get_qoh_on_date($line->stock_id, $order->Location);
66                                 $qoh -= get_demand_qty($line->stock_id, $order->Location);
67                                 $qoh -= get_demand_asm_qty($line->stock_id, $order->Location);
68                                 $qoh -= $line->quantity;
69                                 if ($qoh < $loc['reorder_level'])
70                                 {
71                                         $st_ids[] = $line->stock_id;
72                                         $st_names[] = $line->item_description;
73                                         $st_num[] = $qoh - $loc['reorder_level'];
74                                         $st_reorder[] = $loc['reorder_level'];
75                                 }
76                         }
77                 }
78
79                 $sql = "INSERT INTO ".TB_PREF."sales_order_details (order_no, stk_code, description, unit_price, quantity, discount_percent) VALUES (";
80                 $sql .= $order_no .
81                                 ",".db_escape($line->stock_id).", "
82                                 .db_escape($line->item_description).", $line->price,
83                                 $line->quantity,
84                                 $line->discount_percent)";
85                 db_query($sql, "order Details Cannot be Added");
86
87         } /* inserted line items into sales order details */
88
89         commit_transaction();
90
91         if ($loc_notification == 1 && count($st_ids) > 0)
92         {
93                 require_once($path_to_root . "/reporting/includes/class.mail.inc");
94                 $company = get_company_prefs();
95                 $mail = new email($company['coy_name'], $company['email']);
96                 $from = $company['coy_name'] . " <" . $company['email'] . ">";
97                 $to = $loc['location_name'] . " <" . $loc['email'] . ">";
98                 $subject = _("Stocks below Re-Order Level at " . $loc['location_name']);
99                 $msg = "\n";
100                 for ($i = 0; $i < count($st_ids); $i++)
101                         $msg .= $st_ids[$i] . " " . $st_names[$i] . ", " . _("Re-Order Level") . ": " . $st_reorder[$i] . ", " . _("Below") . ": " . $st_num[$i] . "\n";
102                 $msg .= "\n" . _("Please reorder") . "\n\n";
103                 $msg .= $company['coy_name'];
104                 $mail->to($to);
105                 $mail->subject($subject);
106                 $mail->text($msg);
107                 $ret = $mail->send();
108         }
109         return $order_no;
110 }
111
112 //----------------------------------------------------------------------------------------
113
114 function delete_sales_order($order_no)
115 {
116         begin_transaction();
117
118         $sql = "DELETE FROM ".TB_PREF."sales_orders WHERE order_no=".db_escape($order_no);
119         db_query($sql, "order Header Delete");
120
121         $sql = "DELETE FROM ".TB_PREF."sales_order_details WHERE order_no =".db_escape($order_no);
122         db_query($sql, "order Detail Delete");
123
124         commit_transaction();
125 }
126
127 //----------------------------------------------------------------------------------------
128 // Mark changes in sales_order_details
129 //
130 function update_sales_order_version($order)
131 {
132   foreach ($order as $so_num => $so_ver) {
133   $sql= 'UPDATE '.TB_PREF.'sales_orders SET version=version+1 WHERE order_no='. $so_num.
134         ' AND version='.$so_ver;
135   db_query($sql, 'Concurrent editing conflict while sales order update');
136   }
137 }
138
139 //----------------------------------------------------------------------------------------
140
141 function update_sales_order($order)
142 {
143         global $loc_notification, $path_to_root;
144
145         $del_date = date2sql($order->due_date);
146         $ord_date = date2sql($order->document_date);
147         $order_no =  key($order->trans_no);
148         $version= current($order->trans_no);
149
150         begin_transaction();
151
152         $sql = "UPDATE ".TB_PREF."sales_orders SET type =".db_escape($order->so_type)." ,
153                 debtor_no = " . db_escape($order->customer_id) . ",
154                 branch_code = " . db_escape($order->Branch) . ",
155                 customer_ref = ". db_escape($order->cust_ref) .",
156                 comments = ". db_escape($order->Comments) .",
157                 ord_date = " . db_escape($ord_date) . ",
158                 order_type = " .db_escape($order->sales_type) . ",
159                 ship_via = " . db_escape($order->ship_via) .",
160                 deliver_to = " . db_escape($order->deliver_to) . ",
161                 delivery_address = " . db_escape($order->delivery_address) . ",
162                 contact_phone = " .db_escape($order->phone) . ",
163                 contact_email = " .db_escape($order->email) . ",
164                 freight_cost = " .db_escape($order->freight_cost) .",
165                 from_stk_loc = " .db_escape($order->Location) .",
166                 delivery_date = " .db_escape($del_date). ",
167                 version = ".($version+1)."
168          WHERE order_no=" . $order_no ."
169          AND version=".$version;
170         db_query($sql, "order Cannot be Updated, this can be concurrent edition conflict");
171
172         $sql = "DELETE FROM ".TB_PREF."sales_order_details WHERE order_no =" . $order_no;
173
174         db_query($sql, "Old order Cannot be Deleted");
175
176         if ($loc_notification == 1)
177         {
178                 include_once($path_to_root . "/inventory/includes/inventory_db.inc");
179                 $st_ids = array();
180                 $st_names = array();
181                 $st_num = array();
182                 $st_reorder = array();
183         }
184         foreach ($order->line_items as $line)
185         {
186                 if ($loc_notification == 1 && is_inventory_item($line->stock_id))
187                 {
188                         $sql = "SELECT ".TB_PREF."loc_stock.*, "
189                                   .TB_PREF."locations.location_name, "
190                                   .TB_PREF."locations.email
191                                 FROM ".TB_PREF."loc_stock, "
192                                   .TB_PREF."locations
193                                 WHERE ".TB_PREF."loc_stock.loc_code=".TB_PREF."locations.loc_code
194                                  AND ".TB_PREF."loc_stock.stock_id = ".db_escape($line->stock_id)."
195                                  AND ".TB_PREF."loc_stock.loc_code = ".db_escape($order->Location);
196                         $res = db_query($sql,"a location could not be retreived");
197                         $loc = db_fetch($res);
198                         if ($loc['email'] != "")
199                         {
200                                 $qoh = get_qoh_on_date($line->stock_id, $order->Location);
201                                 $qoh -= get_demand_qty($line->stock_id, $order->Location);
202                                 $qoh -= get_demand_asm_qty($line->stock_id, $order->Location);
203                                 $qoh -= $line->quantity;
204                                 if ($qoh < $loc['reorder_level'])
205                                 {
206                                         $st_ids[] = $line->stock_id;
207                                         $st_names[] = $line->item_description;
208                                         $st_num[] = $qoh - $loc['reorder_level'];
209                                         $st_reorder[] = $loc['reorder_level'];
210                                 }
211                         }
212                 }
213                 $sql = "INSERT INTO ".TB_PREF."sales_order_details
214                  (order_no, stk_code,  description, unit_price, quantity,
215                   discount_percent, qty_sent)
216                  VALUES (";
217                 $sql .= $order_no . ","
218                   .db_escape($line->stock_id) . ","
219                   .db_escape($line->item_description) . ", "
220                   .db_escape($line->price) . ", "
221                   .db_escape($line->quantity) . ", "
222                   .db_escape($line->discount_percent) . ", "
223                   .db_escape($line->qty_done) ." )";
224
225                 db_query($sql, "Old order Cannot be Inserted");
226
227         } /* inserted line items into sales order details */
228
229         commit_transaction();
230         if ($loc_notification == 1 && count($st_ids) > 0)
231         {
232                 require_once($path_to_root . "/reporting/includes/class.mail.inc");
233                 $company = get_company_prefs();
234                 $mail = new email($company['coy_name'], $company['email']);
235                 $from = $company['coy_name'] . " <" . $company['email'] . ">";
236                 $to = $loc['location_name'] . " <" . $loc['email'] . ">";
237                 $subject = _("Stocks below Re-Order Level at " . $loc['location_name']);
238                 $msg = "\n";
239                 for ($i = 0; $i < count($st_ids); $i++)
240                         $msg .= $st_ids[$i] . " " . $st_names[$i] . ", "
241                           . _("Re-Order Level") . ": " . $st_reorder[$i] . ", "
242                           . _("Below") . ": " . $st_num[$i] . "\n";
243                 $msg .= "\n" . _("Please reorder") . "\n\n";
244                 $msg .= $company['coy_name'];
245                 $mail->to($to);
246                 $mail->subject($subject);
247                 $mail->text($msg);
248                 $ret = $mail->send();
249         }
250 }
251
252 //----------------------------------------------------------------------------------------
253
254 function get_sales_order_header($order_no)
255 {
256         $sql = "SELECT ".TB_PREF."sales_orders.*, "
257           .TB_PREF."debtors_master.name, "
258           .TB_PREF."debtors_master.curr_code, "
259           .TB_PREF."debtors_master.email AS master_email, "
260           .TB_PREF."locations.location_name, "
261           .TB_PREF."debtors_master.payment_terms, "
262           .TB_PREF."debtors_master.discount, "
263           .TB_PREF."sales_types.sales_type, "
264           .TB_PREF."sales_types.id AS sales_type_id, "
265           .TB_PREF."sales_types.tax_included, "
266           .TB_PREF."shippers.shipper_name, "
267           .TB_PREF."tax_groups.name AS tax_group_name , "
268           .TB_PREF."tax_groups.id AS tax_group_id
269         FROM ".TB_PREF."sales_orders, "
270           .TB_PREF."debtors_master, "
271           .TB_PREF."sales_types, "
272           .TB_PREF."tax_groups, "
273           .TB_PREF."cust_branch, "
274           .TB_PREF."locations, "
275           .TB_PREF."shippers
276         WHERE ".TB_PREF."sales_orders.order_type=".TB_PREF."sales_types.id
277                 AND ".TB_PREF."cust_branch.branch_code = ".TB_PREF."sales_orders.branch_code
278                 AND ".TB_PREF."cust_branch.tax_group_id = ".TB_PREF."tax_groups.id
279                 AND ".TB_PREF."sales_orders.debtor_no = ".TB_PREF."debtors_master.debtor_no
280                 AND ".TB_PREF."locations.loc_code = ".TB_PREF."sales_orders.from_stk_loc
281                 AND ".TB_PREF."shippers.shipper_id = ".TB_PREF."sales_orders.ship_via
282                 AND ".TB_PREF."sales_orders.order_no = ".db_escape($order_no);
283         $result = db_query($sql, "order Retreival");
284
285         $num = db_num_rows($result);
286         if ($num > 1)
287         {
288                 display_db_error("FATAL : sales order query returned a duplicate - " . db_num_rows($result), $sql, true);
289         }
290         else if ($num == 1)
291         {
292                 return db_fetch($result);
293         }
294         else
295                 display_db_error("FATAL : sales order return nothing - " . db_num_rows($result), $sql, true);
296
297 }
298
299 //----------------------------------------------------------------------------------------
300
301 function get_sales_order_details($order_no) {
302         $sql = "SELECT id, stk_code, unit_price, "
303                 .TB_PREF."sales_order_details.description,"
304                 .TB_PREF."sales_order_details.quantity,
305                   discount_percent,
306                   qty_sent as qty_done, "
307                 .TB_PREF."stock_master.units,
308                 ".TB_PREF."stock_master.material_cost + "
309                         .TB_PREF."stock_master.labour_cost + "
310                         .TB_PREF."stock_master.overhead_cost AS standard_cost
311         FROM ".TB_PREF."sales_order_details, ".TB_PREF."stock_master
312         WHERE ".TB_PREF."sales_order_details.stk_code = ".TB_PREF."stock_master.stock_id
313         AND order_no =".db_escape($order_no)." ORDER BY id";
314
315         return db_query($sql, "Retreive order Line Items");
316 }
317 //----------------------------------------------------------------------------------------
318
319 function read_sales_order($order_no, &$order)
320 {
321         $myrow = get_sales_order_header($order_no);
322
323         $order->trans_type = 30;
324         $order->so_type =  $myrow["type"];
325         $order->trans_no = array($order_no=> $myrow["version"]);
326
327         $order->set_customer($myrow["debtor_no"], $myrow["name"],
328           $myrow["curr_code"], $myrow["discount"]);
329
330         $order->set_branch($myrow["branch_code"], $myrow["tax_group_id"],
331           $myrow["tax_group_name"], $myrow["contact_phone"], $myrow["contact_email"]);
332
333         $order->set_sales_type($myrow["sales_type_id"], $myrow["sales_type"], 
334             $myrow["tax_included"], 0); // no default price calculations on edit
335
336         $order->set_location($myrow["from_stk_loc"], $myrow["location_name"]);
337
338         $order->set_delivery($myrow["ship_via"], $myrow["deliver_to"],
339           $myrow["delivery_address"], $myrow["freight_cost"]);
340
341         $order->cust_ref = $myrow["customer_ref"];
342         $order->sales_type =$myrow["order_type"];
343         $order->Comments = $myrow["comments"];
344         $order->due_date = sql2date($myrow["delivery_date"]);
345         $order->document_date = sql2date($myrow["ord_date"]);
346
347         $result = get_sales_order_details($order_no);
348         if (db_num_rows($result) > 0)
349         {
350                 $line_no=0;
351                 while ($myrow = db_fetch($result))
352                 {
353                         $order->add_to_cart($line_no,$myrow["stk_code"],$myrow["quantity"],
354                                 $myrow["unit_price"], $myrow["discount_percent"],
355                                 $myrow["qty_done"], $myrow["standard_cost"], $myrow["description"], $myrow["id"] );
356                 $line_no++;
357                 }
358         }
359
360         return true;
361 }
362
363 //----------------------------------------------------------------------------------------
364
365 function sales_order_has_deliveries($order_no)
366 {
367         $sql = "SELECT SUM(qty_sent) FROM ".TB_PREF.
368         "sales_order_details WHERE order_no=".db_escape($order_no);
369
370         $result = db_query($sql, "could not query for sales order usage");
371
372         $row = db_fetch_row($result);
373
374         return ($row[0] > 0);
375 }
376
377 //----------------------------------------------------------------------------------------
378
379 function close_sales_order($order_no)
380 {
381         // set the quantity of each item to the already sent quantity. this will mark item as closed.
382         $sql = "UPDATE ".TB_PREF."sales_order_details
383                 SET quantity = qty_sent WHERE order_no = ".db_escape($order_no);
384
385         db_query($sql, "The sales order detail record could not be updated");
386 }
387
388 //---------------------------------------------------------------------------------------------------------------
389
390 function get_invoice_duedate($debtorno, $invdate)
391 {
392         if (!is_date($invdate))
393         {
394                 return Today();
395         }
396         $sql = "SELECT ".TB_PREF."debtors_master.debtor_no, ".TB_PREF."debtors_master.payment_terms, ".TB_PREF."payment_terms.* FROM ".TB_PREF."debtors_master,
397                 ".TB_PREF."payment_terms WHERE ".TB_PREF."debtors_master.payment_terms = ".TB_PREF."payment_terms.terms_indicator AND
398                 ".TB_PREF."debtors_master.debtor_no = ".db_escape($debtorno);
399
400         $result = db_query($sql,"The customer details could not be retrieved");
401         $myrow = db_fetch($result);
402
403         if (db_num_rows($result) == 0)
404                 return $invdate;
405         if ($myrow['day_in_following_month'] > 0)
406                 $duedate = add_days(end_month($invdate), $myrow['day_in_following_month']);
407         else
408                 $duedate = add_days($invdate, $myrow['days_before_due']);
409         return $duedate;
410 }
411
412 function get_customer_to_order($customer_id) {
413
414         // Now check to ensure this account is not on hold */
415         $sql = "SELECT ".TB_PREF."debtors_master.name, "
416                   .TB_PREF."debtors_master.address, "
417                   .TB_PREF."credit_status.dissallow_invoices, "
418                   .TB_PREF."debtors_master.sales_type AS salestype, "
419                   .TB_PREF."debtors_master.dimension_id, "
420                   .TB_PREF."debtors_master.dimension2_id, "
421                   .TB_PREF."sales_types.sales_type, "
422                   .TB_PREF."sales_types.tax_included, "
423                   .TB_PREF."sales_types.factor, "
424                   .TB_PREF."debtors_master.curr_code, "
425                   .TB_PREF."debtors_master.discount,"
426                   .TB_PREF."debtors_master.pymt_discount
427                 FROM ".TB_PREF."debtors_master, "
428                   .TB_PREF."credit_status, "
429                   .TB_PREF."sales_types
430                 WHERE ".TB_PREF."debtors_master.sales_type="
431                   .TB_PREF."sales_types.id
432                 AND ".TB_PREF."debtors_master.credit_status=".TB_PREF."credit_status.id
433                 AND ".TB_PREF."debtors_master.debtor_no = ".db_escape($customer_id);
434
435         $result =db_query($sql,"Customer Record Retreive");
436         return  db_fetch($result);
437 }
438
439 function get_branch_to_order($customer_id, $branch_id) {
440
441         // the branch was also selected from the customer selection so default the delivery details from the customer branches table cust_branch. The order process will ask for branch details later anyway
442                 $sql = "SELECT ".TB_PREF."cust_branch.br_name, "
443                         .TB_PREF."cust_branch.br_address, "
444                         .TB_PREF."cust_branch.br_post_address, "
445                         .TB_PREF."cust_branch.phone, "
446                         .TB_PREF."cust_branch.email,
447                           default_location, location_name, default_ship_via, "
448                         .TB_PREF."tax_groups.name AS tax_group_name, "
449                         .TB_PREF."tax_groups.id AS tax_group_id
450                         FROM ".TB_PREF."cust_branch, "
451                           .TB_PREF."tax_groups, "
452                           .TB_PREF."locations
453                         WHERE ".TB_PREF."cust_branch.tax_group_id = ".TB_PREF."tax_groups.id
454                                 AND ".TB_PREF."locations.loc_code=default_location
455                                 AND ".TB_PREF."cust_branch.branch_code=".db_escape($branch_id)."
456                                 AND ".TB_PREF."cust_branch.debtor_no = ".db_escape($customer_id);
457
458             return db_query($sql,"Customer Branch Record Retreive");
459 }
460 ?>